CVE-2026-65881

HighCVSS 7.5

Published: 28/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

In the Joomla extension Joomdle versions prior to 3.1.1, the default configuration allows read access and password reset of CMS accounts. This is an insecure default configuration.

Risk Assessment

An unauthorized user can read account data or reset passwords, leading to account takeover and data confidentiality breach.

Recommendation

Update the Joomdle extension to version 3.1.1 or later. Change the default configuration to restrict account access.

Other vulnerabilities in Joomdle

CVE-2026-65882Medium
In the Joomla extension Joomdle versions prior to 3.1.1, a Reflected XSS vulnerability was found. The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

Original NVD description (English source)

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.